# kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

kin-openapi ValidateResponse dereferences a nil schema for response headers declared with content instead of schema, panicking the process on every call to that operation.

- Payout: Research
- Severity: high
- Program: kin-openapi
- Found by: vnykmshr
- Disclosed: 2026-10-16
- CVE: CVE-2026-100349
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-74vm-87hj-r66f
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f
- Tags: area:oss domain:oss impact:dos kind:research platform:ghsa sev:high tech:go technique:regression technique:source-review vuln:dos

**Target:** Go library openapi3filter ValidateResponse / decodeValue
**Root cause:** A response header declared with `content` instead of `schema` yields headerRef.Value.Schema == nil; validateResponseHeader passes it to decodeValue, which dereferences schema.Value.AllOf without a nil check.
**Steps:**
1. Load a spec where a response header uses `content: {application/json: {}}` and confirm `doc.Validate()` accepts it.
2. Build ResponseValidationInput with Status 200, a JSON body, and no X-Thing header.
3. Call `openapi3filter.ValidateResponse(ctx, in)`; it panics at req_resp_decoder.go:273 on `schema.Value.AllOf`.
4. Control: same spec with content on the response body returns early at validate_response.go:114 and does not panic.
**How found:** Noticed the request-parameter variant (GHSA-jpcw-4wr7-c3vq) and checked the parallel response-header path; verified the body path returns early on nil schema, so the gap is headers only, and confirmed doc.Validate accepts the shape.
**Exploitation:** Any consumer validating responses against an attacker-supplied or third-party spec (gateways, linters) crashes on every call to the affected operation; declaring the header suffices, no header value needed.
**Insight:** When a sibling advisory fixes a nil-schema crash on one input path (request params), audit the parallel paths (response headers vs body) — the body path had an early nil return while the header path did not. Also grep public spec corpora (apis.guru) to gauge real-world prevalence of the triggering shape.